IT Daily Roundup – September 22, 2026
1. Apple Launches Mac Mini M6 and Mac Studio – First 2nm Chips Now Available
Today, September 22, the new Mac Mini and Mac Studio go on sale. The Mac Mini ships with Apple's M6 chip – the company's very first 2nm processor – featuring a 12-core CPU and GPU, a dual Neural Engine, and up to 40% faster CPU performance compared to the M4 model, starting at $899. The Mac Studio is available with M5 Max or M5 Ultra chips, supporting up to 512 GB of RAM. Pre-orders began on August 25, after Apple made an unusually early announcement driven by unexpectedly strong enterprise demand for AI hardware. Both machines include Wi-Fi 7, Bluetooth 6, and 2.5 GbE Ethernet as standard.
Why this matters: The Mac Mini M6 at $899 is currently one of the most capable desktop workstations in its price range – and with Apple Intelligence integration, it is an attractive option for businesses that want AI tools running locally without cloud dependencies. The strong enterprise appetite for AI hardware reflects a real trend: locally run models (code assistants, internal LLMs, document automation) are increasingly appealing to SMEs who need to keep sensitive data off third-party cloud APIs. IT admins should verify MDM compatibility (Jamf, Intune) for the new models and factor them into updated procurement plans.
2. Microsoft September 2026 Patch Tuesday – Record 974 Patches, Two Zero-Days, CISA Deadline Today
Microsoft released a record-breaking 974 security patches in September – more than double the previous annual record in a single Patch Tuesday. Among them are two actively exploited zero-days: CVE-2026-85880 (CVSS 7.8) – a heap buffer overflow in Windows ALPC (Advanced Local Procedure Call) enabling local privilege escalation to SYSTEM; and CVE-2026-81963 (CVSS 7.8) – an improper link resolution flaw in the Windows Update Stack with the same impact. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog with today (September 22) as the patching deadline for federal agencies – a strong signal of urgency for the private sector as well. In total, Microsoft has now patched 2,760 vulnerabilities in 2026, more than double the previous record year.
Why this matters: Privilege escalation to SYSTEM level is the classic second step in cyberattacks – after an initial foothold (phishing, browser exploit), attackers use a local vulnerability to gain full control of a machine. Windows ALPC is a core Windows inter-process communication mechanism, and the Windows Update Stack is an especially sensitive target. For SMEs: prioritize patching admin workstations, servers, and devices with elevated privileges first. If you don't yet have automated patch management in place (Microsoft Endpoint Manager, Intune, Patch My PC, or similar), today's 974-patch Patch Tuesday is a compelling argument for adopting one – manually tracking updates at this volume is no longer feasible.
3. WordPress Click2Shell – RCE via Phishing Without an Account, Fixed in Version 7.1.1
Security researchers publicly disclosed technical details and a proof-of-concept for the Click2Shell vulnerability in WordPress Core 7.1.0 and earlier on September 21. The attack works in two steps: an attacker with no account at all sends a crafted URL to an administrator (typically via a phishing email or chat message). When the logged-in admin opens the link, WordPress silently force-installs an arbitrary theme from WordPress.org without consent – and since even inactive themes execute PHP code during Customizer previews, the result is arbitrary code execution on the server. WordPress released version 7.1.1 to fix the issue. Temporary mitigation without upgrading: enable the DISALLOW_FILE_MODS constant in wp-config.php.
← All postsWhy this matters: WordPress powers the website of a large share of small and medium businesses. This vulnerability is particularly dangerous because the attacker needs no credentials at all – it is enough for an administrator to click a link, which is a standard phishing technique. A compromised WordPress server can be used to distribute malware to site visitors, steal customer data, or serve as an entry point for ransomware into the broader company network. Recommended actions: update to WordPress 7.1.1 immediately, enable automatic WordPress core updates, and establish a policy that admins do not click external links from emails without verifying the source. If you manage WordPress sites for multiple clients, audit the update status across your entire portfolio today.